Host marvin-mk2 about infra HOT 7 CLOSED

Fixed! We're now hosting it :)

from infra.

You'll need to have a GitHub token secret, right? For that, you'll need to have a GPG key with git-crypt. Also, all the current people who have access to the secrets will need to be okay with you having access.

I am okay with you having access.

Then, you will need to make a PR that adds NixOS configuration for running your bot.

from infra.

Sounds good!

It's built as a GitHub App now, so it will need

• a gpg private key generated by GitHub (this is then used to derive a JWT which is in turn used to ask github for an ephemeral installation token...)
• a webhook secret to make sure the bot only reacts to the real webhook events and
• I think the GH App ID is not public information either, so it can't hurt to treat that as a secret as well.

I haven't used git crypt before. So that would basically mean that someone with an already whitelisted key would add my gpg public key to the whitelist?

Since the secrets should only be a one-time setup, I'd be okay with just letting one of the pre-existing admins set that up if that is easier.

from infra.

You also need access to the secrets to deploy to the server. If you don't care about that, I can add your secrets for you.

from infra.

Ah, I assumed it just deploys directly from github's master. Being able to deploy fixed might be useful, but I could also live without that since there are already 6 admins.

I created #25 to get started with the configuration part. I modeled it after your nixpkgs-update config.

from infra.

Also, all the current people who have access to the secrets will need to be okay with you having access.

Should I open an issue about this? Having to nag one of you every time I'd like to deploy an update is not ideal, especially since I can't control when a deploy happens :)

from infra.

Yes, it's probably best to open another issue, then I can ping all the people with access to get their okay.

from infra.